@odla-ai/cli 0.12.0 → 0.13.0

package/dist/index.cjs

@@ -1003,6 +1003,77 @@ var import_promises = require("stream/promises");
 var import_node_fs4 = require("fs");
 var import_node_path3 = require("path");
 var import_node_url = require("url");
+
+// src/integration-validation.ts
+function validateIntegrations(cfg, path, defaultServices) {
+  if (cfg.integrations === void 0) return;
+  if (!Array.isArray(cfg.integrations)) throw new Error(`${path}: integrations must be an array`);
+  const ids = /* @__PURE__ */ new Set();
+  for (const [index, integration] of cfg.integrations.entries()) {
+    const at = `${path}: integrations[${index}]`;
+    if (!isRecord4(integration)) throw new Error(`${at} must be an object`);
+    if (!validId(integration.id)) throw new Error(`${at}.id must be lowercase letters, numbers, and hyphens`);
+    if (ids.has(integration.id)) throw new Error(`${path}: duplicate integration id "${integration.id}"`);
+    ids.add(integration.id);
+    if (!safeText(integration.title, 200)) throw new Error(`${at}.title is required`);
+    if (!safeText(integration.npm, 200)) throw new Error(`${at}.npm is required`);
+    if (integration.schema !== void 0 && (!isRecord4(integration.schema) || !isRecord4(integration.schema.entities))) {
+      throw new Error(`${at}.schema must contain an entities object`);
+    }
+    if (integration.rules !== void 0 && !isRecord4(integration.rules)) throw new Error(`${at}.rules must be an object`);
+    validateSeeds(integration, at);
+    validateProbes(integration, at);
+  }
+  const needsDb = cfg.integrations.some((integration) => integration.schema || integration.rules || integration.seeds?.length);
+  const services = unique(cfg.services?.length ? cfg.services : defaultServices);
+  if (needsDb && !services.includes("db")) throw new Error(`${path}: schema/rules/seed integrations require the db service`);
+}
+function validateSeeds(integration, at) {
+  if (integration.seeds === void 0) return;
+  if (!Array.isArray(integration.seeds)) throw new Error(`${at}.seeds must be an array`);
+  const ids = /* @__PURE__ */ new Set();
+  for (const [index, seed] of integration.seeds.entries()) {
+    const sat = `${at}.seeds[${index}]`;
+    if (!isRecord4(seed) || !safeText(seed.id, 200) || !safeText(seed.ns, 200)) throw new Error(`${sat} requires id and ns`);
+    if (ids.has(seed.id)) throw new Error(`${at} has duplicate seed id "${seed.id}"`);
+    ids.add(seed.id);
+    if (!isRecord4(seed.key) || !safeText(seed.key.attr, 200) || !safeText(seed.key.value, 2048)) {
+      throw new Error(`${sat}.key requires string attr and value`);
+    }
+    if (!isRecord4(seed.attrs)) throw new Error(`${sat}.attrs must be an object`);
+    if (Object.hasOwn(seed.attrs, seed.key.attr) && seed.attrs[seed.key.attr] !== seed.key.value) {
+      throw new Error(`${sat}.attrs.${seed.key.attr} conflicts with its natural key`);
+    }
+  }
+}
+function validateProbes(integration, at) {
+  if (integration.probes === void 0) return;
+  if (!Array.isArray(integration.probes)) throw new Error(`${at}.probes must be an array`);
+  for (const [index, probe] of integration.probes.entries()) {
+    const pat = `${at}.probes[${index}]`;
+    if (!isRecord4(probe) || !safeProbePath(probe.path)) throw new Error(`${pat}.path must be an absolute path without query or fragment`);
+    if (!Number.isInteger(probe.expectedStatus) || probe.expectedStatus < 100 || probe.expectedStatus > 599) {
+      throw new Error(`${pat}.expectedStatus must be an HTTP status`);
+    }
+  }
+}
+function isRecord4(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function safeText(value, max) {
+  return typeof value === "string" && value.trim().length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
+}
+function safeProbePath(value) {
+  return typeof value === "string" && /^\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*$/.test(value);
+}
+function validId(value) {
+  return typeof value === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value);
+}
+function unique(values) {
+  return [...new Set(values.filter(Boolean))];
+}
+
+// src/config.ts
 var DEFAULT_PLATFORM = "https://odla.ai";
 var DEFAULT_ENVS = ["dev"];
 var DEFAULT_SERVICES = ["db", "ai"];
@@ -1017,8 +1088,8 @@ async function loadProjectConfig(configPath = "odla.config.mjs") {
   validateRawConfig(raw, resolved);
   const platformUrl = trimSlash(process.env.ODLA_PLATFORM_URL || raw.platformUrl || DEFAULT_PLATFORM);
   const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
-  const envs = unique(raw.envs?.length ? raw.envs : DEFAULT_ENVS);
-  const services = unique(raw.services?.length ? raw.services : DEFAULT_SERVICES);
+  const envs = unique2(raw.envs?.length ? raw.envs : DEFAULT_ENVS);
+  const services = unique2(raw.services?.length ? raw.services : DEFAULT_SERVICES);
   validateCalendarConfig(raw, envs, services, resolved);
   const local = {
     tokenFile: (0, import_node_path3.resolve)(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
@@ -1052,6 +1123,8 @@ async function resolveDataExport(cfg, value, names) {
   throw new Error(`${value} did not export ${names.join(", ")} or default`);
 }
 function buildPlan(cfg) {
+  const integrationSchema = cfg.integrations?.some((integration) => integration.schema) ?? false;
+  const integrationRules = cfg.integrations?.some((integration) => integration.rules) ?? false;
   return {
     appId: cfg.app.id,
     appName: cfg.app.name,
@@ -1059,8 +1132,9 @@ function buildPlan(cfg) {
     dbEndpoint: cfg.dbEndpoint,
     envs: cfg.envs,
     services: cfg.services,
-    hasSchema: !!cfg.db?.schema,
-    hasRules: !!cfg.db?.rules || !!cfg.db?.schema && cfg.db.defaultRules !== false,
+    integrations: (cfg.integrations ?? []).map((integration) => integration.id),
+    hasSchema: !!cfg.db?.schema || integrationSchema,
+    hasRules: !!cfg.db?.rules || integrationRules || (!!cfg.db?.schema || integrationSchema) && cfg.db?.defaultRules !== false,
     aiProvider: cfg.ai?.provider
   };
 }
@@ -1069,7 +1143,7 @@ function calendarServiceConfig(cfg, env) {
   if (!cfg.envs.includes(env)) throw new Error(`calendar env "${env}" is not declared in config envs`);
   const google = cfg.calendar?.google;
   if (!google) throw new Error("calendar.google is required when the calendar service is enabled");
-  const availability = unique(
+  const availability = unique2(
     (google.availabilityCalendars?.[env] ?? google.calendars?.[env]).map((id) => id.trim())
   );
   return {
@@ -1105,15 +1179,16 @@ function validateRawConfig(raw, path) {
   if (!raw || typeof raw !== "object") throw new Error(`${path} must export an object`);
   const cfg = raw;
   if (!cfg.app || typeof cfg.app !== "object") throw new Error(`${path}: missing app object`);
-  if (!validId(cfg.app.id)) throw new Error(`${path}: app.id must be lowercase letters, numbers, and hyphens`);
+  if (!validId2(cfg.app.id)) throw new Error(`${path}: app.id must be lowercase letters, numbers, and hyphens`);
   if (!cfg.app.name || typeof cfg.app.name !== "string") throw new Error(`${path}: app.name is required`);
   if (cfg.envs !== void 0 && (!Array.isArray(cfg.envs) || cfg.envs.some((env) => typeof env !== "string"))) {
     throw new Error(`${path}: envs must be an array of names`);
   }
-  if (cfg.envs?.some((env) => !validId(env))) throw new Error(`${path}: env names must be lowercase letters, numbers, and hyphens`);
+  if (cfg.envs?.some((env) => !validId2(env))) throw new Error(`${path}: env names must be lowercase letters, numbers, and hyphens`);
   if (cfg.services !== void 0 && (!Array.isArray(cfg.services) || cfg.services.some((service) => typeof service !== "string" || !service.trim()))) {
     throw new Error(`${path}: services must be an array of non-empty names`);
   }
+  validateIntegrations(cfg, path, DEFAULT_SERVICES);
 }
 function validateCalendarConfig(cfg, envs, services, path) {
   const enabled = services.includes("calendar");
@@ -1121,9 +1196,9 @@ function validateCalendarConfig(cfg, envs, services, path) {
     if (enabled) throw new Error(`${path}: calendar.google is required when services includes "calendar"`);
     return;
   }
-  if (!isRecord4(cfg.calendar)) throw new Error(`${path}: calendar must be an object`);
+  if (!isRecord5(cfg.calendar)) throw new Error(`${path}: calendar must be an object`);
   assertOnly(cfg.calendar, ["google"], `${path}: calendar`);
-  if (!isRecord4(cfg.calendar.google)) throw new Error(`${path}: calendar.google must be an object`);
+  if (!isRecord5(cfg.calendar.google)) throw new Error(`${path}: calendar.google must be an object`);
   const google = cfg.calendar.google;
   assertOnly(
     google,
@@ -1135,7 +1210,7 @@ function validateCalendarConfig(cfg, envs, services, path) {
     throw new Error(`${path}: calendar.google requires exactly one of availabilityCalendars or calendars (legacy)`);
   }
   const availability = google[availabilityKey];
-  if (!isRecord4(availability)) throw new Error(`${path}: calendar.google.${availabilityKey} must map env names to calendar ids`);
+  if (!isRecord5(availability)) throw new Error(`${path}: calendar.google.${availabilityKey} must map env names to calendar ids`);
   const unknownEnv = Object.keys(availability).find((env) => !envs.includes(env));
   if (unknownEnv) throw new Error(`${path}: calendar.google.${availabilityKey}.${unknownEnv} is not in config envs`);
   for (const env of envs) {
@@ -1146,22 +1221,22 @@ function validateCalendarConfig(cfg, envs, services, path) {
     if (ids.length > 10) {
       throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must contain at most 10 calendar ids`);
     }
-    if (ids.some((id) => !safeText(id, 1024))) {
+    if (ids.some((id) => !safeText2(id, 1024))) {
       throw new Error(`${path}: calendar.google.${availabilityKey}.${env} contains an invalid calendar id`);
     }
   }
   if (google.bookingCalendar !== void 0) {
-    if (!isRecord4(google.bookingCalendar)) throw new Error(`${path}: calendar.google.bookingCalendar must map env names to one calendar id`);
+    if (!isRecord5(google.bookingCalendar)) throw new Error(`${path}: calendar.google.bookingCalendar must map env names to one calendar id`);
     const unknownBookingEnv = Object.keys(google.bookingCalendar).find((env) => !envs.includes(env));
     if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingCalendar.${unknownBookingEnv} is not in config envs`);
     for (const [env, value] of Object.entries(google.bookingCalendar)) {
-      if (!safeText(value, 1024)) {
+      if (!safeText2(value, 1024)) {
         throw new Error(`${path}: calendar.google.bookingCalendar.${env} must be a calendar id`);
       }
     }
   }
   if (google.bookingPageUrl !== void 0) {
-    if (!isRecord4(google.bookingPageUrl)) throw new Error(`${path}: calendar.google.bookingPageUrl must map env names to HTTPS URLs or null`);
+    if (!isRecord5(google.bookingPageUrl)) throw new Error(`${path}: calendar.google.bookingPageUrl must map env names to HTTPS URLs or null`);
     const unknownBookingEnv = Object.keys(google.bookingPageUrl).find((env) => !envs.includes(env));
     if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingPageUrl.${unknownBookingEnv} is not in config envs`);
     for (const [env, value] of Object.entries(google.bookingPageUrl)) {
@@ -1176,10 +1251,10 @@ function assertOnly(value, allowed, label) {
   const extra = Object.keys(value).find((key) => !allowed.includes(key));
   if (extra) throw new Error(`${label}.${extra} is not supported`);
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function safeText(value, max) {
+function safeText2(value, max) {
   return typeof value === "string" && value.trim().length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
 }
 function safeHttpsUrl(value) {
@@ -1191,7 +1266,7 @@ function safeHttpsUrl(value) {
     return false;
   }
 }
-function validId(value) {
+function validId2(value) {
   return typeof value === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value);
 }
 async function loadConfigModule(path) {
@@ -1204,7 +1279,7 @@ async function loadConfigModule(path) {
 function trimSlash(value) {
   return value.replace(/\/+$/, "");
 }
-function unique(values) {
+function unique2(values) {
   return [...new Set(values.filter(Boolean))];
 }
 
@@ -1334,9 +1409,9 @@ var CAPABILITIES = {
     "issue, persist, and explicitly rotate configured service credentials",
     "write local Worker values and push deployed Worker secrets through Wrangler stdin",
     "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var",
-    "push db schema/rules and configure platform AI, auth, and deployment links",
+    "compose declared app-capability schema/rules, create guarded seeds when absent, and configure platform AI, auth, and deployment links",
     "apply Google Calendar booking config, then drive state-bound consent, status, discovery, and disconnect flows (bookings run live through the platform proxy)",
-    "validate config offline and smoke-test a provisioned db environment",
+    "validate integration contracts offline and smoke-test a provisioned db environment plus anonymous capability routes",
     "run app-attributed hosted security discovery and independent validation without provider keys",
     "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys",
     "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"
@@ -1344,7 +1419,7 @@ var CAPABILITIES = {
   agent: [
     "install and import the selected odla SDKs",
     "wrap the Worker with withObservability and choose useful telemetry",
-    "make application-specific schema, rules, auth, UI, and migration decisions",
+    "install capability packages, mount their runtime routes, and make application-specific schema, rules, auth, UI, and migration decisions",
     "wire @odla-ai/calendar into trusted Worker code and keep the app admin key out of browsers"
   ],
   human: [
@@ -2016,20 +2091,121 @@ function readPackageJson(rootDir) {
   }
 }
 
+// src/integrations.ts
+var import_node_util = require("util");
+async function resolveDatabaseConfig(cfg, options = {}) {
+  const integrations = cfg.integrations ?? [];
+  if (!cfg.services.includes("db")) return { schema: void 0, rules: void 0, integrations };
+  const authoredSchema = await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]);
+  const schema = mergeSchemas(authoredSchema, integrations);
+  if (options.validateSeeds !== false) assertSeedContracts(integrations, schema);
+  const configuredRules = await resolveDataExport(cfg, cfg.db?.rules, ["rules", "RULES"]);
+  const explicitRules = mergeRules(configuredRules, integrations);
+  const rules = configuredRules === void 0 && schema && cfg.db?.defaultRules !== false ? { ...rulesFromSchema(schema), ...explicitRules ?? {} } : explicitRules;
+  return { schema, rules, integrations };
+}
+function integrationWarnings(integrations, schema, rules) {
+  const warnings = [];
+  const entities = new Set(serializedEntities(schema));
+  for (const integration of integrations) {
+    const namespaces = Object.keys(integration.schema?.entities ?? {});
+    for (const ns of namespaces) {
+      if (!entities.has(ns)) warnings.push(`integration "${integration.id}" schema namespace "${ns}" is missing`);
+      const rule = rules?.[ns];
+      if (!rule) {
+        warnings.push(`integration "${integration.id}" has no rules for "${ns}"`);
+        continue;
+      }
+      for (const action of ["view", "create", "update", "delete"]) {
+        if (rule[action] === void 0) warnings.push(`integration "${integration.id}" rule "${ns}.${action}" is missing`);
+      }
+    }
+    for (const seed of integration.seeds ?? []) {
+      if (!entities.has(seed.ns)) {
+        warnings.push(`integration "${integration.id}" seed "${seed.id}" targets unknown namespace "${seed.ns}"`);
+      } else if (!isUniqueAttr(schema, seed.ns, seed.key.attr)) {
+        warnings.push(`integration "${integration.id}" seed "${seed.id}" key "${seed.ns}.${seed.key.attr}" is not declared unique`);
+      }
+    }
+  }
+  return warnings;
+}
+function mergeSchemas(base, integrations) {
+  const fragments = integrations.filter((integration) => integration.schema);
+  if (fragments.length === 0) return base;
+  const merged = normalizeSchema(base);
+  for (const integration of fragments) {
+    const fragment = normalizeSchema(integration.schema);
+    mergeMap(merged.entities, fragment.entities, `integration "${integration.id}" schema namespace`);
+    mergeMap(merged.links, fragment.links, `integration "${integration.id}" schema link`);
+  }
+  return merged;
+}
+function mergeRules(base, integrations) {
+  const fragments = integrations.filter((integration) => integration.rules);
+  if (fragments.length === 0) return base;
+  const merged = { ...base ?? {} };
+  for (const integration of fragments) {
+    mergeMap(merged, integration.rules ?? {}, `integration "${integration.id}" rule namespace`);
+  }
+  return merged;
+}
+function assertSeedContracts(integrations, schema) {
+  const entities = new Set(serializedEntities(schema));
+  for (const integration of integrations) {
+    for (const seed of integration.seeds ?? []) {
+      if (!entities.has(seed.ns)) {
+        throw new Error(`integration "${integration.id}" seed "${seed.id}" targets unknown namespace "${seed.ns}"`);
+      }
+      if (!isUniqueAttr(schema, seed.ns, seed.key.attr)) {
+        throw new Error(`integration "${integration.id}" seed "${seed.id}" key "${seed.ns}.${seed.key.attr}" must be declared unique`);
+      }
+    }
+  }
+}
+function isUniqueAttr(schema, ns, attr) {
+  if (!isRecord6(schema) || !isRecord6(schema.entities)) return false;
+  const entity = schema.entities[ns];
+  if (!isRecord6(entity) || !isRecord6(entity.attrs)) return false;
+  const definition = entity.attrs[attr];
+  return isRecord6(definition) && definition.unique === true;
+}
+function normalizeSchema(value) {
+  if (value === void 0 || value === null) return { entities: {}, links: {} };
+  if (!isRecord6(value) || !isRecord6(value.entities)) {
+    throw new Error("db schema must be a serialized schema object with an entities map");
+  }
+  if (value.links !== void 0 && !isRecord6(value.links)) throw new Error("db schema links must be an object");
+  return {
+    entities: { ...value.entities },
+    links: { ...value.links ?? {} }
+  };
+}
+function mergeMap(target, fragment, label) {
+  for (const [name, value] of Object.entries(fragment)) {
+    if (Object.hasOwn(target, name) && !(0, import_node_util.isDeepStrictEqual)(target[name], value)) {
+      throw new Error(`${label} "${name}" conflicts with an existing definition`);
+    }
+    target[name] = value;
+  }
+}
+function isRecord6(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
 // src/doctor.ts
 async function doctor(options) {
   const out = options.stdout ?? console;
   const cfg = await loadProjectConfig(options.configPath);
   const plan = buildPlan(cfg);
-  const hasDb = cfg.services.includes("db");
-  const schema = hasDb ? await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]) : void 0;
-  const configuredRules = hasDb ? await resolveDataExport(cfg, cfg.db?.rules, ["rules", "RULES"]) : void 0;
-  const rules = configuredRules ?? (schema && cfg.db?.defaultRules !== false ? rulesFromSchema(schema) : void 0);
+  const database = await resolveDatabaseConfig(cfg, { validateSeeds: false });
+  const { schema, rules } = database;
   const entities = serializedEntities(schema);
   out.log(`config: ${cfg.configPath}`);
   out.log(`app:    ${plan.appName} (${plan.appId})`);
   out.log(`envs:   ${plan.envs.join(", ")}`);
   out.log(`svc:    ${plan.services.join(", ")}`);
+  out.log(`integrations: ${plan.integrations.length ? plan.integrations.join(", ") : "none"}`);
   out.log(`schema: ${schema ? `${entities.length} entities` : "none"}`);
   out.log(`rules:  ${rules ? `${Object.keys(rules).length} namespaces` : "none"}`);
   out.log(`ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "not configured" : "not enabled"}`);
@@ -2051,6 +2227,7 @@ async function doctor(options) {
       if (entities.length > 0 && !entities.includes(ns)) warnings.push(`rules include "${ns}" but schema has no matching entity`);
     }
   }
+  warnings.push(...integrationWarnings(database.integrations, schema, rules));
   if (cfg.services.includes("ai") && !cfg.ai?.provider) warnings.push("ai service is enabled but ai.provider is not set");
   if (cfg.auth?.clerk) {
     for (const [env, value] of Object.entries(cfg.auth.clerk)) {
@@ -2151,8 +2328,8 @@ Commands:
   capabilities Show what the CLI automates vs agent edits and human checkpoints.
   admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
   security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
-  provision    Register services, configure them, persist credentials, optionally push secrets.
-  smoke        Verify local credentials, public-config, live schema, and db aggregate.
+  provision    Register services, compose integrations, persist credentials, optionally push secrets.
+  smoke        Verify credentials, public-config, composed schema, db aggregate, and integration probes.
   skill        Same installer; --agent accepts all, claude, codex, cursor,
                copilot, gemini, or agents (repeatable or comma-separated).
   secrets      Push configured db/o11y secrets into the Worker via wrangler
@@ -2262,6 +2439,9 @@ function configTemplate(input) {
   },
   envs: ${JSON.stringify(input.envs)},
   services: ${JSON.stringify(input.services)},
+  // App capabilities are npm modules, not hosted services. Import their
+  // data-only descriptor and add it here (for example createCrmIntegration()).
+  integrations: [],
   db: {
     schema: "./src/odla/schema.mjs",
     rules: "./src/odla/rules.mjs",
@@ -2339,9 +2519,61 @@ function relativeDisplay(path, rootDir) {
 
 // src/provision.ts
 var import_apps2 = require("@odla-ai/apps");
-var import_ai = require("@odla-ai/ai");
+var import_ai2 = require("@odla-ai/ai");
 var import_node_process7 = __toESM(require("process"), 1);
 
+// src/integration-provision.ts
+var import_db3 = require("@odla-ai/db");
+async function provisionIntegrationSeeds(doFetch, endpoint, tenantId, dbKey, integrations, env, out) {
+  const base = `${endpoint}/app/${encodeURIComponent(tenantId)}`;
+  for (const integration of integrations) {
+    for (const seed of integration.seeds ?? []) {
+      const payload = await postJson(doFetch, `${base}/query`, dbKey, {
+        query: { [seed.ns]: { $: { where: { [seed.key.attr]: seed.key.value }, limit: 1 } } }
+      });
+      const rows = isRecord7(payload) && isRecord7(payload.result) ? payload.result[seed.ns] : void 0;
+      if (!Array.isArray(rows)) {
+        throw new Error(`${env}: integration ${integration.id} seed ${seed.id} query returned an invalid response`);
+      }
+      if (rows.length > 0) {
+        out.log(`${env}: integration ${integration.id} seed ${seed.id} already exists`);
+        continue;
+      }
+      await postJson(doFetch, `${base}/transact`, dbKey, {
+        mutationId: `integration:${integration.id}:seed:${seed.id}`,
+        ops: [{
+          t: "update",
+          ns: seed.ns,
+          // A fresh id plus the declared-unique natural key is create-only: a
+          // concurrent creator gets a unique violation instead of being overwritten.
+          id: (0, import_db3.uuidv7)(),
+          attrs: { ...seed.attrs, [seed.key.attr]: seed.key.value }
+        }]
+      });
+      out.log(`${env}: integration ${integration.id} seed ${seed.id} created`);
+    }
+  }
+}
+async function postJson(doFetch, url, bearer, body) {
+  const res = await doFetch(url, {
+    method: "POST",
+    headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await responseText(res)}`);
+  return res.json().catch(() => ({}));
+}
+function isRecord7(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+async function responseText(res) {
+  try {
+    return redactSecrets((await res.text()).slice(0, 500));
+  } catch {
+    return "";
+  }
+}
+
 // src/provision-credentials.ts
 var import_apps = require("@odla-ai/apps");
 async function provisionEnvCredentials(opts) {
@@ -2401,14 +2633,14 @@ async function mintDbKey(opts, tenantId) {
         appId: tenantId
       })
     });
-    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText2(created)}`);
+    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText3(created)}`);
     res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {
       method: "POST",
       headers,
       body: "{}"
     });
   }
-  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText2(res)}`);
+  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText3(res)}`);
   const body = await res.json();
   if (!body.key) throw new Error(`db key mint (${tenantId}) returned no key`);
   return body.key;
@@ -2424,12 +2656,12 @@ async function issueO11yToken(opts) {
       `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --rotate-o11y-token --push-secrets" to replace it explicitly`
     );
   }
-  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText2(res)}`);
+  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText3(res)}`);
   const body = await res.json();
   if (!body.token) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) returned no token`);
   return body.token;
 }
-async function safeText2(res) {
+async function safeText3(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -2437,6 +2669,18 @@ async function safeText2(res) {
   }
 }
 
+// src/provision-helpers.ts
+var import_ai = require("@odla-ai/ai");
+function serviceRank(service) {
+  if (service === "db") return 0;
+  if (service === "calendar") return 2;
+  return 1;
+}
+function defaultSecretName(provider) {
+  const names = import_ai.DEFAULT_SECRET_NAMES;
+  return names[provider] ?? `${provider}_api_key`;
+}
+
 // src/secrets.ts
 var PROD_ENV_NAMES = /* @__PURE__ */ new Set(["prod", "production"]);
 async function secretsPush(options) {
@@ -2528,19 +2772,23 @@ async function provision(options) {
   out.log(`  db:       ${plan.dbEndpoint}`);
   out.log(`  envs:     ${plan.envs.join(", ")}`);
   out.log(`  services: ${plan.services.join(", ")}`);
+  out.log(`  integrations: ${plan.integrations.length ? plan.integrations.join(", ") : "none"}`);
   const productionEnvs = plan.envs.filter((env) => env === "prod" || env === "production");
   if (!options.dryRun && productionEnvs.length > 0 && !options.yes) {
     throw new Error(
       `refusing to provision production env ${productionEnvs.join(", ")} without --yes; run --dry-run first`
     );
   }
-  const schema = hasDb ? await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]) : void 0;
-  const configuredRules = hasDb ? await resolveDataExport(cfg, cfg.db?.rules, ["rules", "RULES"]) : void 0;
-  const rules = configuredRules ?? (schema && cfg.db?.defaultRules !== false ? rulesFromSchema(schema) : void 0);
+  const database = await resolveDatabaseConfig(cfg);
+  const { schema, rules } = database;
   if (options.dryRun) {
     out.log("dry run: no network calls or file writes");
     out.log(`  schema: ${schema ? "yes" : "no"}`);
     out.log(`  rules:  ${rules ? Object.keys(rules).length : 0} namespaces`);
+    for (const integration of database.integrations) {
+      const namespaces = Object.keys(integration.schema?.entities ?? {}).length;
+      out.log(`  integration.${integration.id}: ${namespaces} namespaces, ${integration.seeds?.length ?? 0} seeds, ${integration.probes?.length ?? 0} smoke probes`);
+    }
     out.log(`  ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "not configured" : "not enabled"}`);
     if (cfg.services.includes("calendar")) {
       for (const env of cfg.envs) {
@@ -2650,18 +2898,21 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       }
     }
     if (schema && dbKey) {
-      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, dbKey, { schema });
+      await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, dbKey, { schema });
       out.log(`${env}: schema pushed`);
     }
     if (rules) {
-      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/admin/rules`, token, rules);
+      await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/admin/rules`, token, rules);
       out.log(`${env}: rules pushed (${Object.keys(rules).length} namespaces)`);
     }
+    if (dbKey) {
+      await provisionIntegrationSeeds(doFetch, cfg.dbEndpoint, tenantId, dbKey, database.integrations, env, out);
+    }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
       const key = import_node_process7.default.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
-        await (0, import_ai.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
+        await (0, import_ai2.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
         out.log(`${env}: ${cfg.ai.provider} key stored in vault (${secretName})`);
       } else {
         out.log(`${env}: ${cfg.ai.keyEnv} not set; skipped provider key storage`);
@@ -2697,11 +2948,6 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
     }
   }
 }
-function serviceRank(service) {
-  if (service === "db") return 0;
-  if (service === "calendar") return 2;
-  return 1;
-}
 async function readRegistryApp(cfg, token, doFetch) {
   const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}`, {
     headers: { authorization: `Bearer ${token}` }
@@ -2711,13 +2957,13 @@ async function readRegistryApp(cfg, token, doFetch) {
   const json = await res.json();
   return json.app ?? null;
 }
-async function postJson(doFetch, url, bearer, body) {
+async function postJson2(doFetch, url, bearer, body) {
   const res = await doFetch(url, {
     method: "POST",
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText3(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText4(res)}`);
 }
 function normalizeClerkConfig(value) {
   if (!value) return null;
@@ -2730,11 +2976,7 @@ function normalizeClerkConfig(value) {
   const publishableKey = envValue(cfg.publishableKey);
   return publishableKey ? { publishableKey, ...cfg.audience ? { audience: cfg.audience } : {}, ...cfg.mode ? { mode: cfg.mode } : {} } : null;
 }
-function defaultSecretName(provider) {
-  const names = import_ai.DEFAULT_SECRET_NAMES;
-  return names[provider] ?? `${provider}_api_key`;
-}
-async function safeText3(res) {
+async function safeText4(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -2743,7 +2985,7 @@ async function safeText3(res) {
 }
 
 // src/secrets-set.ts
-var import_ai2 = require("@odla-ai/ai");
+var import_ai3 = require("@odla-ai/ai");
 var import_apps3 = require("@odla-ai/apps");
 var PROD_ENV_NAMES2 = /* @__PURE__ */ new Set(["prod", "production"]);
 async function secretsSet(options) {
@@ -2755,7 +2997,7 @@ async function secretsSet(options) {
   const { cfg, tenantId, value, doFetch, out } = await resolveVaultWrite(options);
   const token = await getDeveloperToken(cfg, options, doFetch, out);
   try {
-    await (0, import_ai2.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, name, value);
+    await (0, import_ai3.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, name, value);
   } catch (err) {
     throw new Error(scrubValue(err instanceof Error ? err.message : String(err), value));
   }
@@ -3061,7 +3303,7 @@ function formatBudget(usage) {
 
 // src/security-hosted-github.ts
 var import_node_child_process4 = require("child_process");
-var import_node_util = require("util");
+var import_node_util2 = require("util");
 
 // src/security-hosted-request.ts
 async function requestHostedSecurityJson(options, path, init, action) {
@@ -3265,7 +3507,7 @@ async function inferGitHubRepository(cwd = process.cwd(), readOrigin = defaultRe
   return repositoryFromGitRemote(remote);
 }
 async function defaultReadOrigin(cwd) {
-  const result = await (0, import_node_util.promisify)(import_node_child_process4.execFile)(
+  const result = await (0, import_node_util2.promisify)(import_node_child_process4.execFile)(
     "git",
     ["remote", "get-url", "origin"],
     { cwd, encoding: "utf8" }
@@ -4014,7 +4256,8 @@ async function smoke(options) {
     assertCalendarHealthy(status, calendarServiceConfig(cfg, env));
     out.log(`  calendar: ${status.status}, bookable (booking \u2192 ${status.bookingCalendarId ?? "primary"})`);
   }
-  const expectedSchema = await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]);
+  const database = await resolveDatabaseConfig(cfg);
+  const expectedSchema = database.schema;
   const expectedEntities = serializedEntities(expectedSchema);
   const liveSchemaPayload = await getJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/schema`, entry.dbKey);
   const liveSchema = liveSchemaPayload.schema ?? liveSchemaPayload;
@@ -4026,7 +4269,7 @@ async function smoke(options) {
   out.log(`  schema: ${liveEntities.length} entities`);
   const aggregateEntity = expectedEntities[0] ?? liveEntities[0];
   if (aggregateEntity) {
-    const aggregate = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
+    const aggregate = await postJson3(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
       ns: aggregateEntity,
       aggregate: { count: true }
     });
@@ -4035,6 +4278,21 @@ async function smoke(options) {
   } else {
     out.log(`  aggregate: skipped (schema has no entities)`);
   }
+  const probes = database.integrations.flatMap(
+    (integration) => (integration.probes ?? []).map((probe) => ({ integration: integration.id, probe }))
+  );
+  if (probes.length) {
+    const link = cfg.links?.[env];
+    if (!link) throw new Error(`integration smoke probes require links.${env} in odla.config.mjs`);
+    for (const { integration, probe } of probes) {
+      const probeUrl = new URL(probe.path, link).toString();
+      const res = await doFetch(probeUrl, { redirect: "manual" });
+      if (res.status !== probe.expectedStatus) {
+        throw new Error(`integration "${integration}" probe ${probe.path} returned ${res.status}; expected ${probe.expectedStatus}`);
+      }
+      out.log(`  integration.${integration}: ${probe.path} \u2192 ${res.status}`);
+    }
+  }
   out.log("ok");
 }
 function assertCalendarHealthy(status, expected) {
@@ -4052,16 +4310,16 @@ async function getJson(doFetch, url, bearer) {
   const res = await doFetch(url, {
     headers: bearer ? { authorization: `Bearer ${bearer}` } : void 0
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText4(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText5(res)}`);
   return res.json();
 }
-async function postJson2(doFetch, url, bearer, body) {
+async function postJson3(doFetch, url, bearer, body) {
   const res = await doFetch(url, {
     method: "POST",
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText4(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText5(res)}`);
   return res.json();
 }
 function publicConfigUrl(platformUrl, appId, env) {
@@ -4069,7 +4327,7 @@ function publicConfigUrl(platformUrl, appId, env) {
   url.searchParams.set("env", env);
   return url.toString();
 }
-async function safeText4(res) {
+async function safeText5(res) {
   try {
     return (await res.text()).slice(0, 500);
   } catch {